On: Git ransom campaign incident report

[darklajid]

Maybe I misunderstood something, but I read the text as people (or .. services like the three doing the announcement) offering URLs containing an access token?

As in https://example.com/mlindner/project1/821372asd1786d21das or something?

If you use this approach to manage access to a repository, then .. that gets stored in the .git/config. No need to store a password or something.

(Then again, maybe I didn't understand the explanation correctly?)